]> git.ipfire.org Git - thirdparty/mdadm.git/commit
mapfile: set *mapp to NULL after map_free
authorGuoqing Jiang <gqjiang@suse.com>
Thu, 19 Jul 2018 01:40:42 +0000 (09:40 +0800)
committerJes Sorensen <jsorensen@fb.com>
Thu, 19 Jul 2018 17:19:35 +0000 (13:19 -0400)
commit531d7991476f8358a36fb7f320db93d38b0e4c8d
treea751a9ef383c15ca4604ee859b6868253020cba6
parentcf42a1c7074a4f6258e6f0e4c122a93fd9c89850
mapfile: set *mapp to NULL after map_free

We can see "double free or corruption" with below steps
as reported by Mariusz:

export IMSM_NO_PLATFORM=1
export IMSM_DEVNAME_AS_SERIAL=1
mdadm --zero-super /dev/sd*
mdadm -C /dev/md/imsm -n2 -eimsm /dev/sdb /dev/sdc --run
mdadm -C /dev/md/r1 -n2 -z15G -eimsm /dev/sdb /dev/sdc -l1 --run --assume-clean
mdadm -f /dev/md126 /dev/sdb
mdadm -Ss

It is caused by Manage_stop calls map_remove and map_unlock,
but *mapp is not set to NULL after map_remove -> map_free,
so map_unlock will call map_free again.

Reported-by: Tkaczyk Mariusz <mariusz.tkaczyk@intel.com>
Tested-by: Tkaczyk Mariusz <mariusz.tkaczyk@intel.com>
Signed-off-by: Guoqing Jiang <gqjiang@suse.com>
Signed-off-by: Jes Sorensen <jsorensen@fb.com>
mapfile.c